PT-2021-6779 · Node.Js+7 · Node.Js+7

Published 2021-08-12 · Updated 2024-12-16 · CVE-2021-22939

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Node.js (affected versions not specified)

Description The issue is related to insufficient validation of the rejectUnauthorized value in the Node.js https API. If the rejectUnauthorized parameter is set to undefined, no error is returned, and connections to servers with expired certificates are accepted. This allows a remote attacker to compromise data integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALSA-2021:3623

ALSA-2021:3666

ALT-PU-2021-2497

ALT-PU-2021-2550

ALT-PU-2022-3073

AZL-6744

BDU:2022-02171

BIT-NODE-2021-22939

BIT-NODE-MIN-2021-22939

CESA-2021_3623

CESA-2021_3666

CVE-2021-22939

DLA-3137-1

MGASA-2021-0463

OPENSUSE-SU-2021:1214-1

OPENSUSE-SU-2021:1239-1

OPENSUSE-SU-2021:1313-1

OPENSUSE-SU-2021:2875-1

OPENSUSE-SU-2021:2953-1

OPENSUSE-SU-2021:3211-1

OPENSUSE-SU-2021_1214-1

OPENSUSE-SU-2021_1239-1

OPENSUSE-SU-2021_1313-1

OPENSUSE-SU-2021_2875-1

OPENSUSE-SU-2021_2953-1

OPENSUSE-SU-2021_3211-1

OPENSUSE-SU-2024:11096-1

OPENSUSE-SU-2024:11097-1

RHSA-2021:3280

RHSA-2021:3281

RHSA-2021:3623

RHSA-2021:3638

RHSA-2021:3639

RHSA-2021:3666

RHSA-2021_3623

RHSA-2021_3666

RLSA-2021:3623

RLSA-2021:3666

SUSE-SU-2021:2823-1

SUSE-SU-2021:2824-1

SUSE-SU-2021:2875-1

SUSE-SU-2021:2953-1

SUSE-SU-2021:3184-1

SUSE-SU-2021:3211-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Node.Js

Red Hat

Rocky Linux

Suse

References · 124

• 🔥 https://github.com/riptl/cve-2021-3449 · Exploit
• 🔥 https://github.com/terorie/cve-2021-3449 · Exploit
• 🔥 https://github.com/drago-96/CVE-2022-0778 · Exploit
• 🔥 https://github.com/yywing/cve-2022-0778 · Exploit
• 🔥 https://github.com/jkakavas/CVE-2022-0778-POC · Exploit
• 🔥 https://github.com/masahiro331/CVE-2020-8277 · Exploit
• 🔥 https://github.com/MBHudson/CVE-2020-1971 · Exploit
• 🔥 https://hackerone.com/reports/1278254 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2021:2824-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11097-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:3623 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:3623 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-3666.html · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf · Patch
• https://oracle.com/security-alerts/cpujul2022.html · Patch